 araharah-executor
|
22fda6d12a
|
fix(03-04): HMAC data-check-string excludes only hash — signature field participates (real clients rejected as tampered; erratum M6)
|
2026-10-23 01:34:19 +08:00 |
|
|
araharah-executor
|
3ea1fdd932
|
fix(02-bot-skeleton-initdata-security): WR-02 fail-closed /telegram/webhook — unarmed WEBHOOK_SECRET rejects (constant 500, category-only log) before grammY's accept-everything compare
|
2026-10-22 20:18:34 +08:00 |
|
|
araharah-executor
|
8995498bff
|
fix(02-bot-skeleton-initdata-security): WR-01 cap /api/session body at 4 KB before JSON split (413, category-only logs)
|
2026-10-22 20:17:34 +08:00 |
|